CVE-2026-1820
Stored XSS in Media Library Alt Text Editor WordPress Plugin
Publication date: 2026-03-07
Last updated on: 2026-03-07
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability can be detected by identifying if the Media Library Alt Text Editor plugin for WordPress is installed and running a version up to and including 1.0.0. Since the vulnerability involves the shortcode 'bvmalt_sc_div_update_alt_text', checking for the presence of this shortcode in WordPress pages or posts may help detect potential exploitation."}, {'type': 'paragraph', 'content': 'Additionally, monitoring HTTP requests and responses for injected scripts in pages that use this shortcode can indicate exploitation attempts.'}, {'type': 'paragraph', 'content': 'Specific commands to detect the vulnerability are not provided in the available resources.'}] [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the Media Library Alt Text Editor plugin to a version that fixes the vulnerability, if available.
If an update is not available, consider disabling or removing the plugin to prevent exploitation.
Restrict contributor-level and higher user access to trusted users only, as the vulnerability requires authenticated contributor-level access or above.
Can you explain this vulnerability to me?
The Media Library Alt Text Editor plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 1.0.0. This vulnerability exists because the plugin does not properly sanitize and escape user-supplied input in the 'bvmalt_sc_div_update_alt_text' shortcode. As a result, authenticated users with contributor-level access or higher can inject malicious scripts into pages. These scripts will execute whenever any user views the infected page.
How can this vulnerability impact me? :
This vulnerability can allow attackers with contributor-level access or above to inject arbitrary web scripts into pages. These scripts can execute in the context of other users viewing the affected pages, potentially leading to theft of session cookies, defacement, or other malicious actions. The CVSS score of 6.4 indicates a medium severity impact, with potential confidentiality and integrity loss but no impact on availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know